StackRadar

CVE-2026-85091

High

Advisory

Published 3 Sept 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.3
base score, highest
EPSS
0.004
38th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,565
of 17,813 indexed, latest versions
Container images
2,585
deployed by those charts
Fix available
2 of 5
affected packages

CVE-2026-85091 affecting package zlib 1.3.2-1

Carried by container images the latest versions of 2,565 of 17,813 indexed charts deploy, on 2,585 images.

Affected packageAffected versionsFixed inImages
zlibdeb1:1.2.8.dfsg-1ubuntu1, 1:1.2.8.dfsg-1ubuntu1.1, 1:1.2.8.dfsg-2ubuntu4, 1:1.2.8.dfsg-2ubuntu4.1+22 more1:1.3.dfsg+really1.3.1-1+e22,506
zlibapk1.3-r2, 1.3.1-r4, 1.3.1-r5, 1.3.1-r6+6 more1.3.2.1_rc20260601-r078
rsyncdeb3.1.1-3ubuntu1.1, 3.1.1-3ubuntu1.2, 3.1.1-3ubuntu1.3, 3.1.2-2.1ubuntu1+8 moreno fix listed30
klibcdeb2.0.3-0ubuntu1, 2.0.3-0ubuntu1.14.04.3no fix listed7
zlibrpm1.3.1-1.azl3no fix listed1
OSV records
CGA-64hx-6x96-r8f7CGA-6ph6-75jp-484pDEBIAN-CVE-2026-85091UBUNTU-CVE-2026-85091AZL-99090ECHO-2e36-531c-37dd
Also known as
CGA-7955-fhww-9pv3, CGA-m46g-37hm-gpgh

Charts affected

2,565 by stars
ChartLatestAffected imagesRadar Score

Container images carrying it

2,585 by charts deploying them

A fixed version is listed for 2 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
gcr.io/istio-testing/operator:latest8d4576f7b98f
zlib@1:1.3.dfsg-3.1ubuntu2
no fix listed
1
gcr.io/kubecost1/cost-model:prod-1.108.1852f7923fad3
zlib@1:1.2.11.dfsg-2ubuntu9.2
no fix listed
1
gcr.io/kubecost1/frontend:prod-2.5.5991c1465c658
zlib@1.3.1-r6
1.3.2.1_rc20260601-r0
1
gcr.io/kubecost1/frontend:prod-2.6.3a535f7de024b
zlib@1.3.1-r5
1.3.2.1_rc20260601-r0
1
gcr.io/kubecost1/kubecost-network-costs:v0.17.6ab6a54c53fd8
zlib@1.3.1-r4
1.3.2.1_rc20260601-r0
1
gcr.io/ml-pipeline/api-server:2.3.039661bd823e8
zlib@1:1.2.13.dfsg-1
no fix listed
1
gcr.io/ml-pipeline/metadata-envoy:2.0.0-alpha.5e8bc6cf08613
zlib@1:1.2.8.dfsg-2ubuntu4.1
no fix listed
1
gcr.io/ml-pipeline/metadata-envoy:2.3.0e8e263a919ff
zlib@1:1.2.11.dfsg-2ubuntu1.5
no fix listed
1
gcr.io/ml-pipeline/metadata-writer:2.3.09bcfd2abc361
zlib@1:1.2.13.dfsg-1
no fix listed
1
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
zlib@1:1.2.13.dfsg-1
no fix listed
1
gcr.io/tfx-oss-public/ml_metadata_store_server:1.14.051404ef4419c
zlib@1:1.2.11.dfsg-2ubuntu1.5
no fix listed
1
gcr.io/tfx-oss-public/ml_metadata_store_server:1.5.0db8691752b4c
zlib@1:1.2.11.dfsg-0ubuntu2
no fix listed
1
ghcr.io/98jan/smalland-server/smalland-server:deveb7be822d5b2
zlib@1:1.2.11.dfsg-0ubuntu2.2
no fix listed
1
ghcr.io/abcdesktopio/mongo:safe8.0c4c1938a973b
zlib@1:1.3.dfsg-3.1ubuntu2.2
no fix listed
1
ghcr.io/adnoctem/lhci:1.0.119553e4b4033
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/aeharding/voyager:latest779759172676
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
1
ghcr.io/aetrius/msockperf-client/msockperf-client:main820af919c5e2
zlib@1:1.3.dfsg-3.1ubuntu2
no fix listed
1
ghcr.io/aetrius/msockperf-server/msockperf-server:main46ae4ea003e0
zlib@1:1.3.dfsg-3.1ubuntu2
no fix listed
1
ghcr.io/afairgiant/medikeep:v0.70.04c28334f3c79
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/aklivity/zilla:2.4.3e33d59dbb606
zlib@1:1.2.11.dfsg-2ubuntu9.2
no fix listed
1
ghcr.io/alethic/auth0-operator-image:1.4.122468990a8521
zlib@1:1.3.dfsg-3.1ubuntu2.1
no fix listed
1
ghcr.io/alexanderwanyoike/the0/runtime:1.14.7459010a02aff
zlib@1:1.3.dfsg-3.1ubuntu2.2
no fix listed
1
ghcr.io/alexmorbo/dell_idrac_fan_controller:v0.1.6-1d110504d551d
zlib@1:1.3.dfsg-3.1ubuntu2.1
no fix listed
1
ghcr.io/almarklein/timetagger:v26.1.3-nonroot18a81afcb249
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/alpineworks/katalog-migrations:v1.0.562c44a384e13
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/analogj/scrutiny:master-omnibus18689773150d
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/analogj/scrutiny:v0.9.2-web71be54e99608
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
1
ghcr.io/angelscloud/prometheus-optimizer:latest744bc929a579
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
zlib@1:1.3.dfsg-3.1ubuntu2.1
no fix listed
1
ghcr.io/apache/flink-kubernetes-operator:c703255e9c2ce635b89
zlib@1:1.2.11.dfsg-2ubuntu9.2
no fix listed
1
ghcr.io/appscode/csi-driver-cacerts:v0.6.0ab213b156017
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/appscode/gotenberg:8.25f9104080d9a7
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
1
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
zlib@1:1.2.11.dfsg-2ubuntu9.2
no fix listed
1
ghcr.io/appscode/s3proxy:sha-a82ca6820518335f9f9
zlib@1:1.2.11.dfsg-2ubuntu9.2
no fix listed
1
ghcr.io/argoproj-labs/mcp-for-argocd:v0.9.0dffc6c719d86
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/astradns/astradns-agent:v0.2.9-unbound6ba69487f1b0
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/astriaorg/account-monitor:latest4c8b42890035
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/astriaorg/auctioneer:pr-18391386b7b5e555
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/astriaorg/conductor:1.1.01f97d131b1d1
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/astriaorg/evm-bridge-withdrawer:1.0.29c88e1aff357
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/astriaorg/hermes:0.5.04f33a0a9f75e
zlib@1:1.3.dfsg-3.1ubuntu2.1
no fix listed
1
ghcr.io/astriaorg/sequencer:latest44f82ee0b24c
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/astriaorg/sequencer-relayer:latest5f6c74993f08
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/atuinsh/atuin:18.12.0e953fa9e36ef
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/avistotelecom/docker-wazuh-agent:4.12.08766ba08bf1a
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/backstage/backstage:latest792e262ea504
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
1
ghcr.io/base/node-reth:v1.1.18eb6e492fe3c
zlib@1:1.3.dfsg-3.1ubuntu2.1
no fix listed
1
ghcr.io/base-org/node:v0.11.11aba0ffe55ea
zlib@1:1.2.11.dfsg-2ubuntu9.2
no fix listed
1

syft 1.42.1 · advisories as of 19 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.